The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill includes scripts/fetch_ui_tokens.py, which retrieves design tokens from the official ponti-studios/ui repository on GitHub. This process is secure, using HTTPS and targeting only structured .tokens.json files from a verified vendor source.
[COMMAND_EXECUTION]: The scripts/fetch_ui_tokens.py script uses the Python subprocess module to execute a local validation tool (scripts/validate_tokens.py). This is a safe, internal operation that uses the system's Python interpreter and hardcoded local paths to ensure data integrity before tokens are used.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest external design tokens that influence the agent's UI decisions and brand guidance. While this ingestion represents a potential attack surface, the risk is mitigated by strict JSON schema validation and an alias-resolution script that prevents the processing of arbitrary or malicious instructions hidden within the token data.
[SAFE]: Extensive analysis of the skill's instructions and support scripts found no evidence of prompt injection, data exfiltration, or obfuscation. The skill adheres to the principle of least privilege and provides robust, measurable tools for accessibility and design consistency.

kernel-ui